Hi @darrenfuller , thanks for your reply, but I have already discard this solution for the following reason: in this way, if I set the report with cron schedule 1,31,,,* , but then if my report will run at 20:03 for example due to the fact that other report are running in parallel and are absorbing resources my time window of search will not be from 19:30 to 20 but from 19:32 to 20:02 ( please consider that we would like to leave the choice of the window in which start the Scheduled Report to Splunk Scheduler in order to avoid skipped Searches and this is just the first of a series of report that will be scheduled) Could you kindly suggest me a way to obtain my requirement? Regards, Alice ... View more

Hello, thanks for your feedback! Your method is working fine, but in order to have in output also other values from mylookup.csv I have added a lookup command in my final solution (see below). My final solution is the following: | inputlookup mylookup.csv | join _time [search index="my_index" sourcetype="my_sourcetype" my query | fields | timechart span=30min count as "my_value1" ] | my calculation | appendpipe [| stats count | where count==0 | addinfo | eval _time = round (info_min_time,0)| eval"my_value1" = count | lookup "mylookup.csv " _time OUTPUT _time .... fields ... | my calculation] | table _time, ...fields... | eval index_id = "my_id" | eval env="my_env" | eval ... | fields | collect index=test ... View more